Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1760493s -
max time network
156s -
platform
android_x86 -
resource
android-x86-arm-20220823-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20220823-enlocale:en-usos:android-9-x86system -
submitted
29/05/2023, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
A515689B1AF72606064D32894F00F9B03594AD69CC5B311545BAC5AF3B81A43A.apk
Resource
android-x86-arm-20220823-en
Behavioral task
behavioral2
Sample
A515689B1AF72606064D32894F00F9B03594AD69CC5B311545BAC5AF3B81A43A.apk
Resource
android-x64-20220823-en
Behavioral task
behavioral3
Sample
A515689B1AF72606064D32894F00F9B03594AD69CC5B311545BAC5AF3B81A43A.apk
Resource
android-x64-arm64-20220823-en
Behavioral task
behavioral4
Sample
finiiiii.jpg
Resource
win7-20230220-en
Behavioral task
behavioral5
Sample
finiiiii.jpg
Resource
win10v2004-20230220-en
General
-
Target
A515689B1AF72606064D32894F00F9B03594AD69CC5B311545BAC5AF3B81A43A.apk
-
Size
3.7MB
-
MD5
e594324a6a2fd123b38ad4e53b487fc7
-
SHA1
c078793a90ec1f4ceafa184ae7485285e981c6ab
-
SHA256
a515689b1af72606064d32894f00f9b03594ad69cc5b311545bac5af3b81a43a
-
SHA512
24428989f7caa2c5f60520379dde5e38a2852401f592a30f86affe786499e12a3d8d3b8f9f5ee4a9a1f8d73940e37a262db173bf59bb37c880ef8546f4f7947f
-
SSDEEP
98304:KHQMjUMf/fBaGIsavzCPG2fnXz1Dy7Wlwn0dAiRaH6:KwMjUofBbpD47Wvd/0a
Malware Config
Signatures
-
Brata
Brata is a banking trojan malware first seen in 2019.
-
Brata payload 8 IoCs
resource yara_rule behavioral1/files/4038-0.dat family_brata2 behavioral1/files/4038-0.dat family_brata3 behavioral1/memory/4038-0.dex family_brata2 behavioral1/memory/4038-0.dex family_brata3 behavioral1/memory/4172-0.dex family_brata2 behavioral1/memory/4172-0.dex family_brata3 behavioral1/memory/4038-1.dex family_brata2 behavioral1/memory/4038-1.dex family_brata3 -
Makes use of the framework's Accessibility service. 1 IoCs
description ioc Process Framework service call android.accessibilityservice.IAccessibilityServiceConnection.findAccessibilityNodeInfoByAccessibilityId terror.net.sucess -
Acquires the wake lock. 1 IoCs
description ioc Process Framework service call android.os.IPowerManager.acquireWakeLock terror.net.sucess -
Loads dropped Dex/Jar 3 IoCs
Runs executable file dropped to the device during analysis.
ioc pid Process /data/user/0/terror.net.sucess/app_ded/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.dex 4038 terror.net.sucess /data/user/0/terror.net.sucess/app_ded/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.dex 4172 /system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/terror.net.sucess/app_ded/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terror.net.sucess/app_ded/oat/x86/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.odex --compiler-filter=quicken --class-loader-context=& /data/user/0/terror.net.sucess/app_ded/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.dex 4038 terror.net.sucess
Processes
-
terror.net.sucess1⤵
- Makes use of the framework's Accessibility service.
- Acquires the wake lock.
- Loads dropped Dex/Jar
PID:4038 -
/system/bin/dex2oat --instruction-set=x86 --instruction-set-features=ssse3,-sse4.1,-sse4.2,-avx,-avx2,-popcnt --runtime-arg -Xhidden-api-checks --runtime-arg -Xrelocate --boot-image=/system/framework/boot.art --runtime-arg -Xms64m --runtime-arg -Xmx512m --instruction-set-variant=x86 --instruction-set-features=default --inline-max-code-units=0 --compact-dex-level=none --dex-file=/data/user/0/terror.net.sucess/app_ded/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.dex --output-vdex-fd=42 --oat-fd=43 --oat-location=/data/user/0/terror.net.sucess/app_ded/oat/x86/y0ykBYNNdO7w1tRr3UcF4hD2yG3S8apb.odex --compiler-filter=quicken --class-loader-context=&2⤵
- Loads dropped Dex/Jar
PID:4172
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.0MB
MD57ac2fd295f998b86ee07e6cebadd560d
SHA18127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA2563a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
SHA51246117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
-
Filesize
4.0MB
MD57ac2fd295f998b86ee07e6cebadd560d
SHA18127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA2563a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
SHA51246117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
-
Filesize
4.0MB
MD51a489d7bad3e5dcb1abbf72a193edb99
SHA140faf83694242b5b91e7acb0cfc4c750819818d8
SHA256728ccd599428f20fc74323545bcad3e032b4db4762f99389a0790bd656e4d495
SHA5121da6c51ce13c9455aa577add723bde1c0be68e71dbcc5932f037eedcf62cef9d05c1ef0b4eea2643aa81526602d0986515bdb08da2828c98039dffcadd840fb6
-
Filesize
4.0MB
MD57ac2fd295f998b86ee07e6cebadd560d
SHA18127758f2d39f33ef8ec7c814f8f831dca1ea277
SHA2563a97100c8d37923361a01c1c3d763befdaefd68d629094964b7b6be002af3b07
SHA51246117ae873cfd7e1323c885e89a805788bdf9532893d021251dd9a22deac808faef1ba5e05c587f29aa89ec57c63f7d670462cfabcb21c4db8953ad914f3fda4
-
Filesize
12B
MD5abdbb534c848c7edfb4a407c25b29902
SHA162380bdc3037cb5df6c3fb780aaf53073506ba31
SHA256dacfe86fd73d7f9ff41e66a923211c722392d0fa0b838b9a6bfcb0d0e45379d4
SHA512506edaee43849f8ee043930f13b45f53b80d783bb9fa1b9393fe32e0ddea61f5cb31a57d4d1b811a0d2fc6d15dcc0a8f7b1aedd288af328e032ed25884c14bbd
-
Filesize
7B
MD57dc22b2c6a992f0232345df41303f5ea
SHA1d6df1ab7ac275f8c7aff9d010ccfd0db08bbe2d8
SHA256ec72b9566a9c3501838ae30aeeadb527f0b7545902376fe63b7f9739a8ee4acd
SHA512e9ce661a7e6e66e4aa7e35fc8da1248f04347b8b24afc6df1d42cc05ec562ec12102dc5b3b2537be5bbe966f767b7cca2b4f38da80693d02f7f7f4e189c9137e